Privacy Policy

1. At a glance

This section is a short overview. The details are in the sections below.

• What data. Your account and profile data (agency name, your name, email, role, language), technical sign-in and security data, and content that agencies store in the service about their landlords and tenants.
• Why. To provide and administer the service, keep it secure, meet legal requirements and (with your consent) communicate with you about the product.
• Your rights. You can access your data, correct or delete it, restrict processing, object to it and withdraw consent.
• Contact. privacy@orendly.ua.

2. Who we are

The Orendly service is provided by [the legal entity operating Orendly], the operator (controller) of your personal data in respect of the service's own data. In this Policy that entity, together with the service, is referred to as "we" or "Orendly".

For privacy matters, contact privacy@orendly.ua.

If you believe we are infringing your rights, you have the right to lodge a complaint with a supervisory authority. In Ukraine this is the Ukrainian Parliament Commissioner for Human Rights (the Ombudsman). In the EU you may contact the data-protection supervisory authority in your country.

3. Our roles: controller and processor

Depending on the type of data, Orendly acts in different roles.

Controller. For data relating to the service itself, we determine the purposes and means of processing. This includes: agency details; a user's name, email, hashed password, language and role; sign-in metadata; subscription and billing data; support and demo requests.

Processor. For personal data that an agency enters about its landlords and tenants, the agency is the controller and Orendly acts as a processor — handling that data on the agency's documented instructions under a Data Processing Agreement (DPA).

For that reason, requests about a particular landlord's or tenant's data are routed to the relevant agency, which is their controller and provides the substantive response.

4. Data we collect

• Account and profile. Agency name, currency, timezone; a user's name, email, hashed password, language and role.
• Authentication and security. Sign-in metadata — sign-in counts, dates and times, IP addresses (via Devise session tracking and account-lockout mechanisms).
• Content in the service (we act as processor). Data an agency stores about landlords and tenants: contacts (phone, email), an identity document, payout details — all of which are stored encrypted at rest; as well as properties, leases, payments, meter readings and utility bills.
• Uploaded files. Property photos and documents.
• Demo and contact requests. Name, email, phone (email and phone are stored encrypted) and the message text.

5. Where we get data

• Directly from you. When you fill in forms, create an account or contact us.
• From your agency. When an agency stores data about landlords and tenants in the service.
• Automatically. Technical security and usage metadata generated while you use the service.
• From public sources. Orendly ingests publicly available rental listings from third-party sites (for example, OLX, DOM.RIA) to surface potential leads for agencies. This may include the listing's contact details (a contact phone is stored encrypted).

Where we obtain data other than directly from you (in particular from public listings), we still process it in accordance with this Policy, as required by GDPR Article 14.

6. Purposes and legal bases

We process personal data only where we have a legal basis (GDPR Article 6):

• Providing and administering the service — performance of a contract (Art. 6(1)(b)).
• Security, fraud prevention, service improvement and lead matching — our legitimate interests (Art. 6(1)(f)).
• Accounting, tax and legal recordkeeping — compliance with a legal obligation (Art. 6(1)(c)).
• Optional marketing messages and demo follow-up — your consent (Art. 6(1)(a)), which you can withdraw at any time.

7. Cookies

We use only essential and functional cookies and browser local storage. We do not use advertising or third-party tracking technologies. For more, see our Cookie Policy.

8. Who we share data with

We engage a limited set of trusted service providers (sub-processors) that help us run the service:

• hosting and infrastructure;
• object storage for files;
• email delivery.

Data is shared only as needed to run the service. We do not sell personal data. As a processor, we do not share landlords' or tenants' data with anyone except on the agency's instructions or as required by law.

9. International data transfers

Our infrastructure is primarily located in the EU. Ukraine does not have an EU adequacy decision, so where personal data moves between Ukraine and the European Economic Area (EEA) we rely on appropriate safeguards — in particular Standard Contractual Clauses (SCCs).

10. How long we keep data

We keep personal data while the account is active and for as long as the law requires (for example, for accounting periods). After the account ends, data is returned or deleted. Backups cycle out on a routine schedule, so data is removed from them gradually.

11. Security

We apply technical and organisational measures to protect data:

• encryption in transit (TLS);
• encryption at rest for sensitive contact details and identity documents;
• role-based access on a least-privilege basis;
• strict per-agency data isolation;
• audit logging.

That said, no method of transmitting or storing data is 100% secure, so absolute security cannot be guaranteed.

12. Your rights

Under the GDPR and Ukrainian law you have the right to:

• access your personal data;
• rectify inaccurate data;
• erase data (the "right to be forgotten");
• restrict processing;
• receive your data in a portable format (portability);
• object to processing;
• withdraw consent you previously gave.

To exercise these rights, write to privacy@orendly.ua. We respond within 30 days. You also have the right to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights (the Ombudsman) or with an EU supervisory authority.

Note: for landlords' and tenants' data, the agency provides the substantive response as the controller of that data — we will route your request to it.

13. Children's data

The service is for businesses and is not directed at children. We do not knowingly collect personal data of minors.

14. Changes to this Policy

We may update this Policy. The current version, with its update date, is always available on this page. We will announce material changes within the service or by email.

15. Contact

For privacy matters and to exercise your rights, contact privacy@orendly.ua.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Ukraine's Law "On Personal Data Protection" (No. 2297-VI).